# Membership Plugin – Kadence Memberships <= 4.0.5 - Unauthenticated Insecure Direct Object Reference via Registration Payment ID

- **ID:** WPSEC-2026-2994
- **Plugin:** Membership Plugin – Kadence Memberships (`restrict-content`), https://wordpress.org/plugins/restrict-content/
- **Affected versions:** from 3.0 before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/restrict-content
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2994/

## Description

The Membership Plugin – Kadence Memberships plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'rcp_registration_payment_id' parameter in the rcp_send_registration_to_gateway function in all versions up to, and including, 4.0.5, due to missing validation that the posted payment belongs to the current user and matches the membership level being registered. This makes it possible for unauthenticated attackers to send other users' pending payments to the gateway, and to send a pending payment for one membership level to the gateway with the price of a different, cheaper level.

## References

- https://wpsec.com/vuln/WPSEC-2026-2994/
- https://plugins.svn.wordpress.org/restrict-content/tags/4.0.6/
- https://wordpress.org/plugins/restrict-content/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2994/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.